CVE-2026-64146

erofs: fix metabuf leak in inode xattr initialization

State: Published
Severity: Not scored
Published: Jul 19, 2026
Updated: Oct 30, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix metabuf leak in inode xattr initialization

commit bb88e8da0025 ("erofs: use meta buffers for xattr operations") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array.

Some error paths after erofs_read_metabuf() leave through out_unlock without dropping the metabuf, so the folio reference can leak.

Consolidate the cleanup at out_unlock. erofs_put_metabuf() is a no-op if no folio has been acquired, and this keeps all paths after taking EROFS_I_BL_XATTR_BIT covered by a single cleanup site.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 89682dd09efb3825b0f162a72e342c52b69ea14aAffected bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 3812cfe6cb0a5988df4fedcdaf9aab677b9cca61Affected bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before e4a552e0b6413c1af2e140b5bc14bb849b411b57Affected bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before fcb23bb31508b62e8a1b32adf6217820e90e29b0Affected bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 492c73b21fefa36f3869cb2b188ffb7fe37b3a9bAffected bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 79b09c54c6563df9846ca3094bcfd72082c3e1d7Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 89682dd09efb3825b0f162a72e342c52b69ea14aAffected
bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 3812cfe6cb0a5988df4fedcdaf9aab677b9cca61Affected
bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before e4a552e0b6413c1af2e140b5bc14bb849b411b57Affected
bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before fcb23bb31508b62e8a1b32adf6217820e90e29b0Affected
bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 492c73b21fefa36f3869cb2b188ffb7fe37b3a9bAffected
bb88e8da00253bea0e7f0f4cdfd7910572d7799f to before 79b09c54c6563df9846ca3094bcfd72082c3e1d7Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.